Track and trace, 
trial and error 


Assessing South Africa’s approaches to 
privacy in Covid-19 digital contact tracing 



The Media Policy and Democracy Project 


Murray Hunter 




















































Track and trace, trial and error 

Assessing South Africa’s approaches to 
privacy in Covid-19 digital contact tracing 


The Media Policy and Democracy Project 


Digital contact tracing has been at the centre of global concerns about privacy and digital rights during the 
Covid-19 pandemic. In March 2020, South Africa joined dozens of other countries in looking for sophisticated 
technological solutions to aid its contact-tracing efforts, with an ambitious if misguided attempt to use locational 
data from mobile-network operators to help ‘track and trace’ people with the virus. 

While the programme was misconceived - officials abandoned the attempt to use cellular data for contact 
tracing after just a few weeks - it did yield a novel set of privacy protections designed to ensure oversight and 
safeguard against its misuse. In doing so, South Africa appeared in one way to eschew a common global 
narrative about privacy in the pandemic: that crises provoke emergency powers that are only ever excessive, 

expansive and ever-lasting. 

Since then, South Africa’s health authorities’ evolving approach to contact tracing has shifted to a range of other 
digital interventions that seem more carefully considered, but that have often been put into effect with little public 

consultation and haphazard transparency. 

This report attempts to piece together a public record (albeit incomplete) of how the initial digital contact-tracing 
policy was created, why it failed, and what came next. In doing so it gives a first assessment of some the 
privacy and data protection issues that emerged, and a critical reflection on the challenges of policy making in a 
time of crisis, where well-intentioned officials grapple with complex problems under immense pressure. 

It draws on interviews and correspondence with a range of officials from public bodies and industry, in many 
instances on the condition of anonymity because they did not have authorisation to speak publicly. This includes 
initial fact-gathering undertaken in March 2020 in my capacity then as acting advocacy coordinator of the 

amaBhungane Centre for Investigative Journalism. 


Murray Hunter | murray@c1rcleup.org 
November 2020 


My thanks goes to all who participated in this research, including those who may disagree with its findings. 
I would also like to acknowledge valuable help from David Johnson, Marielle Wenger, EIri Voigt, 

Avani Singh, Michael Power, Alexandrine Piriot de Corbion, Eva Blum-Dumontet, Jane Duncan, 
Cherese Thakur and the amaB team, and two long-suffering humans at home 


Cover image by Elmond Jiyane, Government Communication and Information System 


Contents 

Introduction.1 

The opportunities and risks of digital approaches.4 

Scepticism about surveillance powers in South Africa.6 

The directive from Communications.8 

Health authorities’ early thinking on contact tracing.11 

Unpacking the April regulations.12 

Abandoning the ‘location-tracking’ approach.17 

What went wrong?.20 

Misunderstanding of the technology.20 

Misreading international responses.20 

Limited external feedback.21 

Missing fundamentals?.22 

What went right?.23 

The shift to other approaches.26 

CovidConnect.26 

The Bluetooth app.27 

Aggregate mobile data.28 

Further problems with the regulations.30 

Keeping mobile network contact tracing ‘on the books’.30 

Expanding the purpose for data collection.31 

The lessons for privacy.33 

Recommendations.36 

References.38 

























Introduction 



Contact-tracing regulations 
issued to use mobile 
location data (2 April) 

Launch of CovidConnect 
platform (17 July) 


State of disaster 
declared (15 March) 


End to location 
data requests (17 May) 


Launch of 
Covid Alert SA 
app (1 September) 



March April 


May June 


July August September 


Contact tracing is an essential public-health response whereby those who have been 
exposed to the novel coronavirus are Identified and notified as quickly as possible so 
thaf fhey can Isolafe fhemselves"' - became fhe subjecf of various digifal fechnologles, 
prompting notorious debates about data protection and other surveillance risks versus the 
potential for fhese solutions to save lives. 

In March 2020, In the weeks after Its first confirmed cases of CovIdtO, Soufh Africa 
joined dozens of ofher counfrIes In looking for sophlsticafed fechnological solutions 
to aid Its contact-tracing efforts. While different governments had experimented with 
a range of approaches,^ the Initial South African programme sought to use locational 
Information from moblle-nefwork operafors fo help ‘frack and frace’ people wifh Covld-19 
and fhose who had been exposed fo fhem. Locational privacy Is a vital principle In 
digital and communications privacy, because location data can be used to create very 
detailed and Invasive records of a person’s movemenfs, public and privafe activities, and 
personal contacts.^ 


1 World Health Organisation, 'Contact tracing In the context ot COVID-19: Interim guidance', 10 May 2020, https://www.whoJnt/publlcatlons/l/ltem/contact-traclng-ln-the-context- 
ot-covld-19 

2 These Include use ot mobile network data or data from tinanclal transactions to track down patients tor quarantine, as well as apps to monitor people’s movements via GPS, or 
detect people’s proximity to one another via Bluetooth. See https://prlvacylnternatlonal,org/examples/locatlon-data-and-covld-19 

3 A Blumberg & P Eckersley, 'On locational privacy, and how to avoid losing It forever’. White Paper, Electronic Frontier Foundation, 2009, https://www.etf,org/files/etf-focational- 
privacy.pdf 
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South Africa’s Constitution recognises the right to privacy in its Bill of Rights, including 
the right of everyone not to have the privacy of their communications infringed.'* It had 
also produced a data protection law, the Protection of Personal Information Act, which 
will come fully into force in July 2021 after considerable delays. In acknowledging the 
privacy risks of the proposed contact-tracing programme for Covid-19, in April 2020 the 
authorities unveiled a novel set of privacy protections designed to ensure oversight and 
safeguard against its misuse (the ‘April regulations’). These April regulations included the 
appointment of a highly respected judge to oversee and review the workings of the system, 
as well as various transparency measures that in some respects were an improvement to 
South Africa’s longstanding communications surveillance law, known as RICA. Indeed, the 
April regulations seemed to establish safeguards for South Africa’s digital contact-tracing 
programme that appear to have been shaped by years of criticism, activism and public 
advocacy directed at state surveillance in democratic South Africa. 

It has largely gone without public comment that the attempt to use location data from 
mobile networks failed almost from the start, with health authorities pivoting away from 
the approach barely six weeks after it was announced. Since then. South Africa’s evolving 
approach to contact tracing has shifted to a range of other digital interventions - including 
through the messaging platform known as CovidConnect, and the Covid Alert Bluetooth- 
based app. These interventions seem more carefully considered, although I argue that 
they have often been implemented with a lack of public consultation and with haphazard 
transparency. 

As much as it was a policy failure in terms of its ineffectiveness, elements of the first 
policy represented a step forward for how the South African state thinks about privacy 
safeguards. At the same time, at its heart the digital contact-tracing initiative was 
arguably borne from technological ‘solutionism’ - a policymaking tendency that seeks out 
improbable technological ‘fixes’ to complex problems. This, I would argue, has been a 
common feature of governments’ responses to the pandemic, and many other governance 
challenges as well. 


4 Constitution of Republic of South Africa, 1996, sec 14. 
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This paper attempts to piece together a basic pubiic record of how the poiicy was created, 
why it faiied, and what came next, it draws on interviews and correspondence with a range 
of officiais from pubiic bodies and industry, in many instances on the condition of anonymity 
because they did not have authorisation to speak pubiiciy. This is necessary in the first instance 
because there has been a iack of pubiic disciosure and investigative research on this smaii 
part of the broader South African response to Covid-19. Then the paper wiii attempt a criticai 
assessment of the events surrounding South Africa’s first attempts at digitai contact tracing, 
and what iessons can be drawn for privacy protections and poiicy making in a time of crisis. 

in doing so, this research aims to contribute to a criticai assessment of the iessons can be 
drawn for privacy protections and poiicy making in a time of crisis, where weii-intentioned 
officiais grappie with compiex probiems under immense pressure. 
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The opportunities and risks of 
digital approaches 



In South Africa, ‘manual’ contact tracing was coordinated at a provincial level and district 
level, so approaches varied, but generally appears to have been undertaken through a 
combination of volunteers and healthcare workers in ‘call centre’ setups. 

The case for digital contact tracing stems from the virus’s notorious infectiousness. Contact 
tracing is recognised as one crucial strategy to contain the spread of infections, but it is a 
labour-intensive process.® An influential modelling exercise published in Science found that 
the process needs to be fast and fairly comprehensive to work. If most contacts of known 
Covid-19 cases could be notified and isolated in less than a day, the spread of infections slows 
dramatically; if the process drags out to just three days, it does little to contain the epidemic.® 
The researchers behind this model concluded that this result is unlikely to be achieved at scale 
without reliance on digital and automated contact tracing, such as through an app. 

In a June 2020 guidance note, the World Health Organisation recognised the potential 
for digital tools to augment or automate contact tracing efforts, with the caveat that 
there was still limited evidence to measure the effectiveness of such interventions - and 
that in any case these could only be effective as part of a much broader public-health 
infrastructure which includes well-staffed health services, rapid testing, and manual 
contact tracing capacity. 

As ever, the potential for tech-driven health initiatives comes with caveats: interventions that 
rely on people’s access to digital technology may amplify socioeconomic and healthcare 
inequalities, and often bear huge risks to privacy and other human rights.^ 

There was early awareness of the risk that emergency responses to the pandemic by 
governments could wittingly or unwittingly result in lasting damage to human rights and the 
democratic climate of their societies. In March 2020, a panel of UN Special Rapporteurs 

5 Rjr example, an account from the early day of South Africa’s pandemic followed the efforts of a team of 20 contact tracers working Into the night to track down more than 

1000 people exposed to the vims at a mass chureh gathering. See Bhekisisa Centre for Health Journalism, 'Can you pause a pandemic? Inside the race to stop the spread of 
COVID-19 In South Afriea’, 26 March 2020, https:/^hekisisa.org/features/2020-03-26-can-you-pause-a-pandemlc-inside-the-race-to-stop-the-spread-of-covld19-in-south- 
africa/ 

6 L Ferrets and others, 'QuanStying SARS-CoV2 transmission suggests epidemic control with digital contact tracing’. Science, 368,6491,8 May 2020, DOI: 10.1126/science. 
abb6936 

7 U Gasser and others, ’Digital tools against COVID-19: Taxonomy, ethical challenges, and navigaSon aid’. Lancet Digital Health, 2020,2, 29 June 2020, https://doi. 0 rg/l 0.1016/ 
S2589-7500{20)30137-0 
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and independent experts issued a statement calling for world governments to ensure their 
pandemic responses upheld basic human rights, and warned against the use of emergency 
measures to quash dissent or to take legal or politioal shortouts whioh oould allow 
‘exoessive powers to beoome hardwired into legal and politioal systems.’® While a foous 
on state exoesses is understandable given the fundamental role of national governments in 
leading publio-health responses, the pandemio era has also oome with new opportunities 
for global teoh giants and smaller industry players alike to angle for influenoe and profit.® 

With the first oonfirmed Covid-19 ease on 5 Maroh 2020, the arrival of the pandemio 
in South Afrioa sparked a rapid and intensive response from government. Within 10 
days of the first oonfirmed ease, the President deolared a national state of disaster. 
Under the Disaster Management Aot, the President announoed that the oountry would 
go into a hard lookdown on 27 Maroh, whioh would go on to last several months; oabinet 
ministers issued a oasoade of new regulations and emergenoy polioies, applying not only 
to oonventional publio-health matters but to many details of publio life, from presoribed 
hours for exeroise to the sale of hot food. Some parts of the state response were less 
trivial; the deployment of polioe and soldiers to the streets to enforoe the lookdown 
resulted in widespread reports of brutality and harassment, and at least ten deaths. 
Thus, while aspeots of South Afrioa’s response to the pandemio earned the praise of the 
World Health Organisation and others,at least some parts of government’s response 
seemed to oonfirm fears that the orisis would result in seourooratio exoesses."'^ 

Against this baokdrop sits South Afrioa’s approaoh to oontaot traoing, where initial 
analyses tended to frame the initial intervention as falling within a global trend either of 
high-teoh health innovation or worrying surveillanoe overreaoh. 


8 UN Office of the High Commissioner on Human Rights, COViD-19: States shouid not abuse emergency measures to suppress human rights - UN experts, 16 March 2020, 
https://www,ohchr.org/EN/NewsEvents/Pages/DispiayNews,aspx?NewsiD=25722&LangiD=E 

9 D Lyon, 'The coronavirus pandemic highlights the need for a surveiiiance debate beyond “privacy"'. The Conversation, May 2020, https://theconversation,com/the-coronavirus- 
pandemic-highiights-the-need-for-a-surveiiiance-debate-beyond-privaey-137060 

10 Vievi/finder, 'Detaiis of two addilonai aileged iockdown kiiiings by poiiee reveaied', 30 Aprii 2020, http;//viewfinder.org.za/detaiis-of-two-additionai-aiieged-ioekdown-kiiiings-by- 
poiiee-reveaied/ 

11 iOL, 'Coronavirus in SA: WHO boss praises South Africa’s response to Covid-19 pandemic', 1 Aprii 2020, https://www.ioi,co.za/news/poiitics/coronavirus-in-sa-who-boss- 
praises-south-africas-response-to-covid-19-pandemic-45923836 

12 See New Erame editoriai, 'South Africa faces a stark poiiticai choice', 29 May 2020, https://www,newframe.com/south-africa-faces-a-stark-poiiticai-choice/ 
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Scepticism about surveillance 
powers in South Africa 


The concern that South African authorities would abuse a new spying power was far 
from theoretical. When he assumed office in 2018, President Cyril Ramaphosa launched 
a review of the State Seourity Agenoy, whioh found damning evidenoe of oriminality and 
abuse of power within the intelligenoe struotures."'^ This followed a pattern of dooumented 
abuses of the state’s existing oommunioations surveillanoe powers, in whioh seourity 
agenoies - and individual offioials within them - took advantage of weak safeguards, laok 
of oversight and legal loopholes to spy on various adversaries, inoluding journalists, anti- 
oorruption investigators, and peroeived politioal rivals."''* 

Pertinent to digital traoking during Covid-19, this pattern of abuse inoluded apparent 
abuses of aooess to looational privaoy: while South Afrioa’s main surveillanoe law, known 
as RICA,"'^ generally requires a judge to pre-authorise any interoeption of a person’s 
oommunioations or metadata, it also inoludes an emergenoy prooedure to traoe a 
person’s number without the prior authorisation of a judge. Available data shows that 
polioe offioials use this emergenoy prooedure thousands of times every year without 
explanation."'® In some oontexts, looational privaoy is also a matter of personal safety. 
This point seems to have been ohillingly made in the reoent assassination of a senior 
polioe deteotive in Cape Town; state proseoutors allege that his assassins had traoked 
his movements through illioit aooess to his oellular looation data."'^ 

In February 2020, just weeks before South Afrioa reoorded its first Covid-19 oase, the 
Constitutional Court heard arguments in amaBhungane, a ohallenge to the oonstitutionality 
of the oountry’s primary surveillanoe law, RICA, whioh resulted from a government spying 
operation against journalist Sam Sole."'® 


13 Presidency of the Republic of South Africa, 'High-level Review Panel Report on the State Seeurity Agency', December 2018, http://www.thepresidency.gov,za/download/file/ 
fid/1518 

14 M Hunter, 'Cops and call records: Policing and metadata privacy in South Africa’, Media Policy and Democracy Project, 2020, https://mediaanddemocracy.com/ 

15 The full title of RICA is the Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002. 

16 J Duncan, Stopping the spies: Constructing and resisting the surveillance state in South Africa. Johannesburg: Wits University Press, 2018,101. 

17 Daily Maverick, 'Common cellphone tracking service used in ambush and murder of top policeman Kinnear', 23 September 2020, https://www.dailymaverick.co.za/ 
article/2020-09-23-common-cellphone-tracking-service-used-in-ambush-and-murder-of-top-policeman-kinnear/ 

18 amaBhungane Centre for Investigative Journalism NPC & Another v Minister of Justice and Correctional Services & Others, CCT 278/19. 
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At the time of writing, judgment in the Constitutional Court is still pending, but the High 
Court had previously ruled overwhelming in amaBhungane’s favour, ordering major ohanges 
to the Aot whioh would boost transparenoy and oversight on how the state undertakes 
oommunioations surveillanoe. If upheld by the Constitutional Court, these provisional 
ohanges would be a signifioant move to address well-dooumented weaknesses in the 
privaoy safeguards established in RICA. 

Of partioular note is that the oourt ordered that RICA should be amended to inolude a 
‘user notifioation’ provision, meaning that people whose oommunioations are interoepted 
under RICA should generally be notified after the faot."'® This would strike down a seoreoy 
provision in RICA whioh expressly prohibits any of the parties involved in an interoeption 
from ‘tipping off’ a target of the interoeption, even after an investigation has been 
oonoluded. User notifioation is a basio feature of international standards for suoh laws;^° 
oritios of RICA had long argued that the laok of post-surveillanoe notifioation in South 
Afrioa’ surveillanoe law had helped spying abuses to go undeteoted.^"' 


19 amaBhungane Centre for Investigative Journaiism NPC & Another v Minister of Justice and Correctionai Services & Others (25978/2017) [2019] ZAGPPHC 384; [2019[ Aii SA 
343 (GP); 2020 (1) SA 90 (GP), 16 September 2019. 

20 See African Commission on Human and Peopies' Rights, Deciaration of principies of freedom of expression and access to information in Africa, 2019; The internationai Principies 
on the Appiication of Human Rights to Oommunioations Surveiiianee, 2014, https://necessaryandproportionate.org/ 

21 M Hunter, 'Open ietter to Bheki Ceie, RiCA victim', News24,25 Febmary 2020, https://www.news24.eom/news24/Coiumnists/GuestColumn/open-ietter-to-bheki-ceie-rica- 
victim-20200225 
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The directive from 
Communications 


8. INDIVIDUAL TRACK AND TRACE 

8.1 The Electronic Communication Network Service (ENCS) and Electronic 
Communication Service (ECS) Licensees, internet and digital sector in 
general, must provide location-based services in collaboration with the 
relevant authorities identified to support designated departments to 
assist and combat the spread of COVID-19. 


A week before the release of the ‘April regulations’ on oontaot traoing, another government 
department had provoked signifioant privaoy oonoerns when it announoed the first proposal 
to use oell phone data to traok the spread of Covid-19 in South Afrioa. This oame from the 
Minister of Communioations and Digital Teohnologies, who issued a set of direotions to the 
oommunioations industry just a few hours before South Afrioa’s first hard lookdown was set 
to begin. It inoluded a paragraph under the heading ‘Traok and Traoe’: 

The Electronic Communication Network Service (ENCS) and Electronic 
Communication Service (ECS) licensees, internet and the digital sector in general 
are directed to provide location-based services in collaboration with the relevant 
authorities identified to support designated departments to assist and combat the 
spread of COVID-19.^^ 

The direotive appeared to oonfirm fears that the publio-health orisis would result in 
expansive surveillanoe powers^^, though in retrospeot it appeared the offioials involved had 
largely been oblivious to the privaoy implioations of their proposal. Yet in its vagueness, the 
drafting left muoh open to interpretation: was this a provision to traok individuals’ looations 
via oommunioations networks, or for the state to get aggregate network data to measure 
population movements? 

22 Minister of Communications and Digitai Technoiogy, Directions, GN 417, 26 March 2020, 

23 A Singh & M Power, 'New digitai reguiations mean the state can track you - no questions asked,' Maii & Guardian, 31 March 2020, https://mg,co.za/articie/2020-03-31 -new- 
digitai-reguiations-mean-the-state-can-track-you-no-questions-asked/ 
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In a prior briefing, the had said mobile-network operators would provide ‘data analytios’ to 
help traok the spread of the virus, although it was not olear if this would involve individuals’ 
looation-data or aggregated network data.^'^ 

Pressed for oomment. South Afrioa’s largest mobile operators suggested that the 
oompanies would not deviate from their ourrent obligations under law. In response to a 
telephonio inquiry at the time, I reoeived a terse statement from MTN that read: 

MTN will continue to follow the standard legislated protocols for looation based 
servioes as with any other suoh request that is made under normal (non-COVID-19) 
oiroumstanoes. 

A Vodaoom spokesperson also emphasised that the oompany would not provide 
oustomer information outside of existing legal meohanisms, but speoulated (inoorreotly) 
that the Minister’s proposal would apply to aggregated network data: 

Having said that, our understanding of the data information request outlined 
yesterday by Minister Stella Ndabeni-Abrahams is for high-level aggregated data on 
how people are moving to help ourb the spread of Covid-19. This does not inolude 
personal information or information that identifies a speoifio individual.^^ 

However, in a television interview later that week, the Minister seemed to make olear that 
the polioy was intended to allow for individualised traoking, and that the oolleotive health 
emergenoy outweighed any risks to privaoy or other oivil liberties: 

As part of the regulations, we’re engaging the responsible departments, whioh is 
Justioe [and] State Seourity to say, how do you make sure that we oan oontribute 
in terms of traoing individuals, as you know that when you’re going for the test, you 
fill in the form and put on your details. And then to say, we oan know if this person 
has tested positive in this area, therefore, that information may be provided so that 
we oan traoe it per area and say in this area, these are the individuals that are there. 
[...] But of oourse we’re in engagement with the Department of Justioe on this to say 
how legal it will be in our oase, but also, do appreoiate the faot that we’re operating 
under the Disaster Management Aot. We are working together to say. What are other 
methods oan we introduoe to make sure that you oan help, beoause it is also not 


24 Oral briefing by Minister of Communications and Digital Technology, 24 March 2020. 

25 Email from Jacqui O'Sullivan, MTN spokesperson, on 26 March 2020. 

26 Email from Byron Kennedy, Vodaoom spokesperson, on 26 March 2020, 
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good that we want to protect only the rights of individuals at the expense of 
the rights of the country. In this instance, we’re looking at the only right that 
matters for now: the right to have life [emphasis added]. 

In this initial foray by the Minister of Communioations, it appeared that South Afrioa was 
set to follow the worst impulses of orisis-driven polioy making. With a single paragraph of 
its polioy direotive, her department had proposed to enaot an unpreoedented expansion 
of the state’s power to aooess people’s oommunioations data - with no provisions for 
oversight, limits or safeguards, and little evidenoe that proteotions for the right to privaoy 
had been oonsidered at all. Even under RICA - an interoeptions law whioh faoes very 
real prospeots of being struok down as unoonstitutional - suoh information is treated as 
sensitive enough that the polioe and intelligenoe agenoies would only be granted aooess 
under very limited oiroumstanoes, and generally only with the prior approval of a judge 
or magistrate.^® 

Yet if this polioy move would have the effeot of expanding the state’s surveillanoe 
oapability, there was little evidenoe that it was the result of a oynioal ‘power grab’ on 
the part of authorities. Rather, my engagements with offioials around the Ministry and 
Department seemed to suggest that there had been limited oonsideration of the privaoy 
implioations for the proposed soheme, or how it would depart from existing laws. 

For example, a spokesperson for the Minister seemed nonplussed by oonoerns that this 
polioy had implioations for privaoy - on the basis that authorities would only be seeking 
users’ looational data, as opposed to ‘sensitive’ information, and oould say little about 
whether the drafters had oonsidered existing legal safeguards for privaoy.^® 

In any oase, within a week this polioy direotive by the Minister of Communioations would 
be replaoed. A muoh more detailed set of regulations issued on 2 April by the Ministry 
of Cooperative Governanoe and Traditional Affairs, had been driven by the Department 
of Justioe and legal advisors within the Presidenoy - with no involvement, either in the 
drafting of the polioy or in the polioy itself, of the Ministry of Communioations. Where the 
preoeding direotive had been a single paragraph, the new regulations ran to four pages, 
and oontained signifioant detail on privaoy proteotions and oversight. 

27 S Ndabeni-Abrahams, Interview on SABC Morning Live, 25 March 2020. 

28 M Hunter, 'Digitai privacy in the time ot pandemics,’ amaBhungane, 31 March 2020, https://amabhungane.org/advocacy/advocacy-comment-digitai-privacy-in-the-time-ot- 
pandemics/ 

29 Emaii from Nthabaieng Mokitimi, spokesperson tor the Minister, on 27 March 2020, 
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Health authorities’ early thinking on contact tracing 

I have been unable to determine how the direotive from the Ministry of Communioations 
oame to be, and whether it had been an early pit-stop on the way to a more detailed polioy, 
or simply a regulatory oul-de-sao. One reading - buttressed by statements of the Minister 
and her staff - is that it was entirely an initiative of that department, with little involvement 
or prompting from their oounterparts in the Ministry of Health. However, this researoh has 
determined that the health authorities leading South Afrioa’s response to the virus had 
oonsidered aggressive digital oontaot traoing from very early on. 

The interest in a digitised oontaot-traoing approaoh was borne in part from reoognition that 
oases oould inorease at a speed that ‘manual’ oontaot traoers oan struggle to matoh, a 
point emphasised by various health offioials interviewed for this researoh. 

An advisor from the National Institute for Communioable Diseases suggested that South 
Afrioa’s health authorities had expressed interest in digital oontaot traoing from the very 
early days of the pandemio, based on reported suooesses in China. 

We had been aware at the NICD of the Chinese systems for oontaot traoing, whioh 
were the use of these mobiie network operator data in order to traok individuate. That 
had been wideiy pubiioised as a suooess story through news ohanneis and the tike... ^ 

The Minister of Health had oonvened a meeting in late Maroh between health offioials and 
senior representatives of Telkom and BCX, a Telkom subsidiary, to disouss development 
of a traok-and-traoe solution drawing on lessons from China - and this shaped South 
Afrioa’s initial digital oontaot-traoing approaoh, whioh aimed to use looational information 
from mobile networks. 


30 Interview with Kerrigan McCarthy, National Institute for Communicable Diseases, on 28 September 2020. 


The directive from Communications 


11 



Unpacking the April 
regulations 



8 No. 43199 GOVERNMENT GAZETTE, 2 APRIL 2020 


6. The following Chapter Is hereby Inserted into the Regulations after regulation 

11G: 

"CHAPTER 3 

Contact tracing 

11H. (1) In this regulation— 

(a) “COVID-19 Tracing Database” means the database established by the 
National Department of Health in terms of subregulation (2); and 

(b) ‘‘COVID-19 Designated Judge” means a judge designated in terms of 
subregulation (13). 

(2) The National Department of Health shall develop and 
maintain a national database to enable the tracing of persons who are known or 
reasonably suspected to have come into contact with any person known or 
reasonably suspected to have contracted COVID-19. 


On 2 April 2020, the Minister of Cooperative Governance and Traditional Affairs 
published the policy framework for the state’s digital contact tracing regime - 
Regulation 11H (the ‘April regulations’). It was exactly four weeks after South Africa’s 
first confirmed infection, and also the same day that the count of confirmed Covid-19 
cases in the country reached 1,462. 

Regulation 11H outlined the process for gathering such information, and a variety of 
restrictions on its use, as well as oversight and transparency measures designed to protect 
against misuse and strike an appropriate balance between the right to privacy and the 
safeguarding of public health.^'' 

The regulations provided for the establishment of a Covid-19 tracing database, where any 
relevant information gathered from communication networks would be stored, along with a 

31 Government Gazette no 43199, 2 April 2020, 
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much wider array of information gathered by the National Department of Health to enable 
the traoing of people known to have tested positive for Covid-19 and oontaots to whom 
they had been exposed. This database would inolude all information of patients tested in 
the publio and private health seotors, inoluding the names, addresses, identity numbers of 
everyone who is tested for Covid-19, inoluding those who text negative. 

The regulations vested the power in the Direotor General of Health to aooess users’ 
looational information for oontaot traoing, by direoting any ‘eleotronio oommunioations 
servioe provider’^^ to hand over looational information about any person known or 
believed to have Covid-19, and anyone they have or are reasonably suspeoted to have 
oome into oontaot with - exolusively for the purpose of oontaot traoing. 

The regulations detailed several notable key privaoy proteotions, inoluding limiting how 
the powers oould be used, by whom, and for how long, and they installed a judge to 
provide oversight, as well as various transparenoy measures, detailed below: 

• Limit on what the policy could be used for: The regulations established a fairly 
striot purpose limitation for the use of oommunioations data for oontaot traoing, in 
that the polioy only allowed authorities to seek information relating to the looation and 
movements of persons believed to have oontraoted or been exposed to the virus, and 
only for the purposes of ‘addressing, preventing or oombatting the spread of Covid-19 
through the oontaot-traoing prooess.’^^ The information sought was not striotly limited 
to locational information (a broad reading of the regulation suggests that it might apply 
to other kinds of information from whioh looation and movement oould be inferred); 
however, the regulation expressly prohibits this oontaot-traoing prooess from being 
used to interoept the content of oommunioation.^'* While South Afrioan law has been 
oritioised for giving greater privaoy proteotions to oommunioation content on the faulty 
assumption that it is more sensitive than oommunioation metadata ,the prohibition on 
interoepting oontent narrowed one possible way for the April oontaot-traoing regulation 
to be abused. 

• Limit on who may use the policy: The fact that these powers were invested 
specifically in the health authorities could itself be seen as an important safeguard. 

32 Under law this would include a range of industries, including internet serviee providers, fixed-line operators and mobile network operators; however, this researeh found that in 
design and implementation that polcy was principally directed at mobile-network operators. Research on communications surveiilance in South Africa often suggests that the 
state’s interceptions capacity leans towards mobile telephony as well. 

33 Regulation 11 H(11)b. 

34 Regulation 11H(12). 

35 Hunter, ‘Cops and call records’, 12-13, 
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Investing such powers in South Africa’s security agencies may well have increased 
the risk of their abuse, both because of the notorious challenges for accountability 
and oversight of these structures,^® and because of their existing prerogatives to 
intercept communication for law enforcement and intelligence purposes. The police and 
intelligence services clearly would have other work to which contact-tracing powers 
could be turned. But, that such a policy would exclude any role for South Africa’s 
security agencies was by no means a given; as I discuss below, in early discussions 
officials assumed that the competence would fall to South Africa’s law-enforcement or 
intelligence agencies - presumably because South Africa’s interceptions legislation had 
already established a technical interface for data handovers from the mobile networks 
to these agencies. There was global precedent for this: in Israel, for example, the Shin 
Bhet security agency had already been enrolled in contact tracing using a controversial 
national-security interception tool.®^ 

• Establishing special judicial oversight: In a structure that echoed the ‘RICA oversight 
system, the regulations established a ‘Covid-19 Designated Judge’, appointed by the 
Minister of Justice, to receive a weekly report setting out the names and details of any 
person who is traced using this system. Thus, the regulations stopped short of giving 
the judge final authorisation in these decisions, but nonetheless provided oversight. 

The regulations also empowered the judge to make recommendations to ministers on 
amending the regulations, including to further protect privacy.®® 

• Establishing user notification: The regulations provided that any person whose 
movements were traced in this system must be notified within six weeks of the end 
of the declared state of disaster. This represented a significant reversal of the state’s 
position on user notification in communications surveillance: in the legal challenge to 
the state’s surveillance law in the High Court and Constitutional Court in amaBhungane, 
various state bodies raised profound objections to this principle. While these agencies’ 
main claim against user-notification in amaBhungane was that it would be self- 
defeating in security and policing contexts, officials have also been known to argue 
that post-surveillance notification would put an unacceptable logistical burden on the 
authorities.®® The addition of user-notification in South Africa’s proposed digital contact 
tracing was a notable safeguard in its own right, albeit subject to a delay, but also 

36 J Duncan, The rise of the securocrats: The ease of South Africa. Johannesburg: Jacana Media, 2014,114-118. 

37 Times of israei, 'Shin Bet chief impiores ministers not to renew coronavirus surveiiiance’, 21 June 2020, https://www.timesofisraei.com/shin-bet-chief-impiores-ministers-not-to- 
renew-eoronavirus-surveiilance/ 

38 Reguiation11H(13)-(15). 

39 Hunter, 'Cops and cail records’, 29. 
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represented an evolution in the state’s position sinoe amaBhungane started working its 
way through the oourts in 2017. 

• Establishing time limits and expiry date: The regulations put time limits on the use 

of these powers. No request oould be made about a person’s movement reaohing 
bank earlier than Maroh 2020 when the President deolared a national state of disaster; 
any data that is oolleoted as part of the oontaot-traoing prooess should be destroyed 
within six weeks if not needed for oontaot traoing; most importantly, the data-oolleotion 
regulation itself would expire when the deolared state of disaster lapses.These 
provisions addressed a oentral oonoern arising from the global spread of Covid-19 
emergenoy measures: that the emergenoy measures would outlast the emergenoy, and 
be turned to other purposes. The regulations did not require the outright destruotion 
of the traoing database itself - whioh oontains details of any persons who had been 
tested for Covid-19 and any information that was used for oontaot traoing. Rather, the 
regulation required that this database be stripped of any identifying information, and 
retained for publio-health researoh going forward. The de-identifioation prooess must 
oonform to any direotions issued by the Covid-19 designated judge to proteot the 
privaoy of those whose information was oolleoted.'^'' 

• Other transparency measures: As additional transparenoy measures, the regulations 
required that the Direotor General of Health and the designated judge must submit 
reports to Parliament on the shuttering of the oontaot-traoing system. 

This framework earned oautious aoknowledgement for its oonoessions to privaoy,'’^^ with 
some oaveats - for example, surveillanoe soholar Jane Dunoan noted that the judioial 
oversight of the system was limited to ‘after the faot’ sorutiny of traoking deoisions, rather 
than the power to adjudioate traoking deoisions before the faot, whioh is the oommon 
standard for judioial oversight in oommunioations surveillanoe.'^^ The faot that the polioy 
oalled for some data from the traoing database to be de-identified and retained for researoh 
purposes raised oonoerns about the inoreasing potential for ‘anonymous’ datasets to 
be re-identified.Others noted that oertain safeguards oould easily be improved - for 
example, by providing that people whose data was assessed through the regulation would 

40 Regulation 11 (H)17. 

41 Regulation 11 (H)17. 

42 D Milo & L Pillay, Tracing contacts by limiting privacy in the Covid-19 world: Constitutional or unlawful?’ Daily Maverick, 8 April 2020, https://www,dailymaverick,co.za/ 
article/2020-04-08-tracing-contacts-by-limiting-privacy-in-the-covid-19-world-constitutional-or-unlawful/ 

43 J Duncan 'Covid-19, cellphone location tracking and SA's contradictory security response’. Daily Maverick, 6 April 2020, https://www.dailymaverick.co.za/ar1icle/2020- 
04-06-covid-19-cellphone-location-tracking-and-sas-contradictory-security-response/ 

44 M Hunter & C Thakur, 'Advocacy: New privacy rules for Covid-19 tracking a step in the right direction, but,,. News24,4 April 2020, https://vwvw,news24.com/news24/Colum- 
nists/Gues€olumn/advocacy-new-privacy-ruies-for-covid-19-tracking-a-step-in-the-right-direction-but-20200404-2 
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be notified on an ongoing basis, rather than deferring notifioation to some distant endpoint 
when the pandemio might subside.'*® 

These oaveats aside, these analyses seemed to agree that the regulations were a sign of 
seriousness on the part of the state to ensure that its digital oontaot-traoing efforts showed 
due regard for privaoy, and would not be repurposed for other surveillanoe purposes. This 
sense of seriousness was undersoored when the Minister of Justioe named a partioularly 
highly regarded jurist as the ‘designated Covid-19 judge’ who would oversee the digital 
oontaot-traoing system: former Constitutional Court justioe Kate O’Regan.'*® 

Even then, it is hard to assess the safeguards and privaoy proteotions in the April regulations 
purely on their own merits, or even on the signs of progress in the state’s views sinoe 
amaBhungane. A key faotor is that the privaoy proteotions in the April regulations had by 
no means seemed a oertain outoome, judged both by the spread of problematio Covid-19 
surveillanoe programmes globally, and by the ohaotio and ill-oonsidered proposals being 
disoussed within South Afrioan state struotures leading up to the April regulations. 

A senior figure in the prooess told me that the April regulations had only been developed 
after authorities had reoeived legal advise that it would have been unlawful to try use RICA 
to traok users’ looations for oontaot traoing. I oould not establish whether authorities 
had made any interoeption requests under RICA before this happened. That the April 
approaoh would be fooused only on teleoommunioations data was also no oertain 
outoome: several souroes told me that there was signifioant interest among polioymakers 
to inolude banking data in the ‘traok and traoe’ polioy, in an effort to replioate some of 
the reported interventions in South Korea. Aooording to an advisor in the prooess, the 
Banking Assooiation of South Afrioa had been involved in assessing the feasibility of this, 
but ultimately the exeoutive rejeoted the proposal due to privaoy oonoerns. 


45 A Giilwald and others, ‘Mobile phone data is usetui in coronavirus battle. But are people protected enough?’, The Conversation, 27 April 2020, https://theconversation.com/ 
mobile-phone-data-is-usetul-in-coronavirus-battle-but-are-people-protected-enough-136404 

46 Statement by the Minister ot Justice and Correctional Services, 3 April 2020, https://justice.gov.za/m_statements/2020/20200403-Covid-19-JusticeORegan.pdf 
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Abandoning the ‘location¬ 
tracking’ approach 


By early May, Health officials were already shifting to develop new approaches to digital 
contact tracing, after realising that the location-tracking method was unfeasible. By mid 
May, requests for user location data from mobile networks had ceased, less than six weeks 
after the system had been announce - though this only emerged months later. 

In late June, there were furtheramendmentsto the April contact-tracing regulations. Although 
there was no media release or statement to note or explain the amendments, they had the 
effect of shifting the purpose of the regulation from contact tracing to ‘geospatial hotspot 
mapping’, and to make provision for contact tracing through a mobile app.'^^ According to 
the Covld-19 designated judge, these amendments followed a set of recommendations that 
she had tabled with cabinet ministers following her conclusion that the original objective of 
the contact-tracing regulations was unfeasible. Among those recommendations were that 
government should end the pursuit of contact tracing through mobile network data; that 
It should explore the use of aggregated network data for ‘hotspot’ mapping; that It should 
study the deployment of contact-tracing apps In other countries to assess the case for a 
South African app; and should undertake Independent security audits of the systems It had 
set up.'^® (As It happens, the amendment regulations did not actually close off the potential 
to request users’ network data for contact tracing - a point I return to later.). 

The Department of Health was slow to announce this change. In late April, the Sunday Times 
had reported that the ambitious digital contact-tracing system was still In development. While 
the Department had made requests to mobile network operators. It said It had not yet tracked 
any person, but a spokesperson projected confidence that the system was In development: 

We are finalising the data linkages to receive the information, and this is not fully 
operational as yet, ’ health spokesperson Popo Maja told the Sunday Times. ‘We 
have been continuing with our current method of contact tracing until the IT system 
is fully functional. ’ He said the development of the system is on schedule and that 
further information on the project will be made available when everything is in place.^*^ 

47 Government Gazette no 43476, 25 June 2020. 

48 Interview with K 0‘Regan, Govid-19 Designated Judge, on 1 July 2020. 

49 Sunday Times, 'Hi-tech system to trace Covid-19 contacts still being built', 26 April 2020, https://www.timeslive.co.za/sunday-times/news/2020-04-26-hi-tech-system-to- 
trace-covid-19-contacts—still-being-built/ 
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The Department of Health would not make further dlsolosures on Its approaoh to digital 
oontaot traoing until mid-July, when National Department of Health polloy offlolal MllanI 
Wolmarans appeared In a virtual hearing of the Western Cape provinolal parliament. For 
several months the provinolal Parliament’s Covld-19 oversight oommittee had sought to 
get a representative from the National Department of Health to give a presentation on 
what was assumed to be an ongoing oommunloatlons-survelllanoe programme. When 
Wolmarans finally appeared on 17 July, It was to tell the provinolal oommittee that the 
department had long before oeased trying to use oellular looatlon data for oontaot traoing: 

Currently the National Department of Health is not involved in a digitised system that 
is a surveillanoe programme, in other words where we are monitoring the movement 
or looation of any oitizen in the oountry... There was an attempt to develop a system 
that would allow us to do that. However teohnioal oomplexities and the privaoy 
oonoerns around this and the proteotion around that had us move towards a more 
aotive-based oontaot-traoing servioe rather than a surveillanoe system using the 
data of the mobile network operators.^ 

Wolmarans told the oommittee that data had only been sought from mobile networks 
under the oontaot-traoing programme from 17 April to 15 May 2020, and that all data 
oolleoted In that period had subsequently had been destroyed. 

Desorlblng the programme as having merely been a ‘proof of oonoept’, Wolmarans outlined 
a range of problems that had made the programme unworkable. Firstly, she oonfirmed 
that oellular looatlon data simply was not aoourate enough for oontaot traoing, estimating 
that It oould only pIn-poInt a person within 50 to 200 metres, depending on the level of 
urbanisation and density of oellular towers. 

Wolmarans added that In most Instanoes the Department had not aotually reoelved 
looatlonal Information about people, only the physloal address to whioh their SIM oard was 
registered, whioh was sometimes Inaoourate or out of date, telling the oommittee: ‘There 
were a number of those where we found the address of the user of the phone and the 
RICA address were oompletely different, even In different towns.’ (It should be noted that 
a Vodaoom spokesperson told me the oompany had provided the Department with fairly 
detailed oall-related data.®"') 

50 Presentation by Milani Wolmarans, Ad-hoc committee on Covid-19, Western Cape Provincial Parliament, 17 July 2020. Video hearing available at: https://www.youtube.com/ 
watch?v=YMGbVLQgGZc 

51 An email from Vodaoom spokesperson Byron Kennedy on 5 October 2020 said, Vodacom has provided the location data and date and time ot calls made and received ot 
COVID-19 positive subscribers to the Department of Health during the national state of disaster. This is the same historic call data (without the B party information, i.e, who the call 
was made to or received from) that we will normally provide to SAPS when we are served with a Section 205 Subpoena from the court,' 
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Wolmarans also pointed out that a devioe or phone number was found not always 
a reliable proxy for a person, telling the oommittee that ‘There are quite a number of 
individuals in South Afrioa that have up to five different phones that they are using.’ 
A similar set of assumptions had been oritioised in ‘big data’ responses to the 2014-2016 
Ebola outbreak.“ 

Wolmarans did not say how many requests the Department had made to mobile network 
operators before it abandoned the approaoh. At the time of writing, it is still unolear how 
many requests were made, despite written requests to various offioials in the Department 
of Health and teleooms industry. In late April, a spokesperson for Vodaoom told the Sunday 
Times that it had provided data for 800 of its oustomers; this would have been just over 
a week after Wolmarans said the Department of Health started making suoh requests, 
on 17 April.Of the other network operators, MTN reportedly deolined to say how many 
requests it had reoeived, and Cell C and Telkom did not respond to questions. 

There is more to be said about the oontaot-traoing approaohes that would follow, and 
there are lessons to be learned from the rapid development and quiok oonolusion to the 
approaoh first attempted through the April regulations. 


52 S Erikson, 'Cell phones & self and other problems with big data detection and containment during epidemics,’ Medical Anthropology Quarterly, 32,3,2018. 

53 Sunday Times, 'Hi-tech system to trace Covld-19 contacts still being built', 26 April 2020, https://www.timeslive.co.za/sunday-times/news/2020-04-26-hi-tech-system-to- 
trace-covid-19-contacts—still-being-built/ 
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What went wrong? 


Misunderstanding of the technology 

At its heart, the policy appears to have been shaped by a dramatic over-estimation of 
the accuracy of the locational data available to mobile networks, and its usefulness for 
contact tracing. 

Explaining the initial allure of the envisaged system, one health official said: 

That was the great carrot that was dangling in front of us the whole time. We thought, 
if this works, then fantastio, beoause that would mean that you oould enhanoe the 
effeotiveness ofoontaot traoing without any administrative overhead. So it was done 
with a lot of positive intent, but didn’t work.^'^ 

For the purposes of contact tracing, the National Institute for Communicable Diseases 
(NICD) initially defined a close contact as someone who has been within two metres of a 
Covid-19 positive person, or within a closed space with them.^® The locational information 
from mobile networks simply lacks the granularity needed to pinpoint a person’s location 
to that level of accuracy. In criminal investigations, researchers have used triangulation 
to get a more accurate picture of a person’s precise location, but only long after the fact 
and using analysis of tower records which would not ordinarily be stored in a user’s call 
records.^® Leaving aside accuracy, locational data from a person’s call records would only 
show the location of one party; a much wider data set would be needed to even begin to 
estimate who they might have been exposed to. 

Misreading international responses 

It is hard to overlook a fetishisation of high-tech responses to Covid-19 in international 
media, academic and policy circles. If it is true that South Africa’s initial approach in 
digital contact tracing was modelled on an understanding of approaches in China, and 

54 Interview with Gaurang Tanna, NDoH, on 28 September 2020. 

55 National Insfltute for Communicable Diseases, Guidelines for COVID-19 Version 2.0,8 March 2020. 

56 Interview with Jason Jordaan, DFIRtABS, on 10 January 2020. 
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an understanding that these were critical to successful containment of the pandemio, it is 
not at all olear that either understanding was oorreot. On the same day that South Afrioa 
published its first oontaot traoing regulations, 2 April, the Financial Times published a long- 
form artiole exploring the haphazard results borne by Chinese state surveillanoe in oontaot 
traoing in general, and in use of oellular data in partioular: 

While telecoms data has helped some looal governments pin down potential 
ooronavirus oases, there have been many problems with the information. Carriers 
traok phone looations through the transmission towers to whioh users oonneot. The 
looation data is not always aoourate: depending on oell tower ooverage, the estimated 
looations oan be out by as muoh as 2 km.^'^ 

Rather, the writers suggested, the most effeotive teohnologioal interventions in the outbreak 
had been the simplest, suoh as online medioal questionnaires and health-oheoks when 
entering publio spaoes. This is to say nothing of the role of rapid testing oapaoity in China.®® 

Limited external feedback 

That the original polioy was ill-oonoeived is not oontested by those in Health. However, 
offioials desoribe the deoision-making prooess as being shaped by the understandable 
urgenoy of the moment, whioh allowed little room for delay or external input that may have 
identified inoorreot assumptions or blindspots: 

If we had just mapped out our data flow processes, and done some exploratory 
questioning around how feasible this idea is, we would have spent less time and 
energy on it, beoause we would have been reliably informed that this was not going 
to work. I think part of the reason we didn’t do that was beoause there was so muoh 
momentum on this projeot. We had the brightest minds, oapable programmers 
[in Telkom BCX], and they were itohing to go... We didn’t have the neoessary 
perspeotive to stand baok and think, well, what are we trying to do? And maybe 
that speaks to the oversight, the projeot oonoeptualization. But all of that is in the 
oontext of the immense pressure that we needed to do something today for our 
health servioes.^^ 


57 Financial Times, ‘China, coronavirus and surveillance: the messy reality of personal data’, 2 April 2020. 

58 New York Times, 'Here’s how Wuhan tested 6,5 million for coronavirus in days’, 26 May 2020, https://www.nytimes.eom/2020/05/26/world/asia/coronavirus-wuhan-tests.html 

59 Interview with Kerrigan McCarthy, National Institute for Communicable Diseases, on 2 November 2020 
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Missing fundamentals? 

The accuracy and usefulness of fhe dafa soughf in Soufh Africa’s firsf affempfs af digifal 
confact tracing may not be the only issue at stake. One provincial health official pointed 
to the understandably stretohed oapaoity of the health servioes themselves as a huge 
limiting faotor to any effeotive intervention, telling me: ‘I oan’t go into the usefulness of the 
[mobile network] data, but the big question is what are we going to do with it? You need 
a squadron of data soientists, and very oompetent managers, to ask relevant questions of 
the data.’ 

Health authorities have been frank about the struotural ohallenges faoing many parts of 
South Afrioa’s health system. While the oauses for these are diverse, it may be that some 
of these ohallenges were always going to be an obstaole to any attempt to digitise or 
automate oontaot traoing in South Afrioa. For example, various delays in turning around 
testing results beoame a big problem for South Afrioa’s health servioes, espeoially as 
Covid-19 oases surged. 

With mounting oases, and test results regularly taking a week or more, one dootor who 
volunteered in a oontaot-traoing oall oentre in the early months of the pandemio told me 
oontaot traoing was ‘like farting into a thunderstorm.’ In May 2020, it was reported that 
patients were waiting up to ten days to get their test results.®'' In June 2020, the national 
laboratory servioes told Parliament it was oonduoting about 15,000 tests a day, but had a 
baoklog of over 70,000 samples, due in part to global test shortages.®^ These signifioant 
ohallenges would surely hinder even a better-oonoeived digital oontaot-traoing approaoh. 


60 The modelling by Ferretti and others, 2020 {see n 5), suggested that after just three days' delay, notifying and isolating contacts of a person with Covid-19 does little to slow the 
spread of the virus, 

61 Bhekisisa Centre for Health Journalism, 'National COVID-19 testing backlog means patients wait up to 10 days for results', 8 May 2020, https://bhekisisa.org/heaith-news- 
south-africa/2020-05-08-south-africa-covid19-coronavirus-testing-national-backlog-nhls/ 

62 National Health Laboratory Service, Presentation to Parliament's health committee, 10 June 2020, https://pmg.org,za/committee-meeting/30439/ 
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What went right? 


As a contact-tracing programme, the scheme devised in the April regulations was a 
failure. Yet its rapid abandonment oould also be seen as a kind of suooess. Firstly, in 
the nontext of fears that health-surveillanoe powers would be re-purposed and abused, 
there is some oomfort that health offioials ohose not to pursue a surveillanoe polioy if it 
was not effeotive for the purpose it had been set up. Seoondly, the deoision to abandon 
and amend the oontaot-traoing polioy is a oredit to one of the safeguards written into 
the regulations - the oversight and reoommendation power granted to the Covid-19 
designated judge. 

In an interview in July 2020, Justioe Kate O’Regan oonfirmed that she had reoommended 
an end to the attempt to use mobile looation data for oontaot traoing, along with a range 
of other polioy reoommendations: 

My advice to government was that at the ourrent state of soienoe, there is absoiuteiy 
no suggestion that iooation data from oeii phones wiii provide suffioientiy aoourate 
information for oontaot traoing, and that the reguiation shouid be amended to make 
oiear that the information obtained from mobiie network operators wiii not be used 
for that purpose. 

Justioe O’Regan added that her other reoommendations inoluded the potential for 
aggregated network data to be used for ‘hotspot’ mapping; that government should do 
independent seourity audits of the systems it had established, and that it should study 
deployment of oontaot-traoing apps in other oountries to assess the ease for a South 
Afriean app. 

In oonsidering the merits of the oversight role envisaged by the oreation of a Covid-19 
designated judge, O’Regan emphasised the importanoe of these reoommendation 
powers, whioh she desoribed as ‘the meat of the role’. She argued that this forms part 
of an iterative approaoh to polioy-making whioh is neoessary in unpreoedented arises. 


63 Interview with K 0‘Regan, Covid-19 Designated Judge, on 1 July 2020. 
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The recommendation power is important because this pandemic is unfoiding very 
fast. And we are having to make poiicy in circumstances where the science is not 
yet ready And so the oniy way to make poiicy in those oiroumstanoes is iterativeiy 
As we keep iearning, we keep reviewing and revising our poiioy and I think it’s quite 
arguabie that it is a duty in a pandemio. And the reoommendation rote aiiows a sort 
of independent engagement with the poiioy-making process around oontaot traoing 
and the use of digitai technoiogy to aid the oombating of the disease. And in that 
way it’s not very RICA-iike.^ 

While she was at pains not to express a view on the oonstitutionality of the Covid-19 
regulations, O’Regan argued that the reoommendation powers in the oontext of 
Covid-19 surveillanoe was a more important safeguard than the power to pre-authorise 
eaoh traoking request. One of the early oritioisms of the regulations was that it had 
fallen short of giving the Covid-19 designated judge the pre-authorisation powers that 
would be afforded to a judge overseeing interception of oommunioations by polioe or 
intelligenoe agenoies in RICA.®® O’Regan argued that the unohanging oiroumstanoes of 
eaoh oontaot-traoing request left limited soope for meaningfully adjudioating oontaot- 
traoing requests oompared to the wide range of faotors that might be adjudioated in an 
interoeption request for seourity or law enforoement purposes: 

In oiroumstanoes where you’re taiking about whether you shouid permit the 
surveiiianoe of a partiouiar person, the oonditions and oiroumstanoes of that 
partiouiar person at that partiouiar time are oruoiai to making that deoision. When 
you’re deoiding in oircumstanoe of a pubiio heaith emergenoy whether you shouid 
know where a person with a partiouiar disease is, the variabiiity of that person’s 
oiroumstanoes is entireiy different.^^ 

Thus, although the oontaot-traoing system oreated through the regulations was unworkable, 
the reoommendation powers oreated through the regulations paved the way for a shift in 
oontaot-traoing polioies. 


64 Interview with K 0‘Regan. 

65 J Duncan, 'Staring down the securocrats', about:intel, 7 April 2020, https://aboutintel,eu/covid-surveillance-south-africa/ 

66 Interview with K O'Regan. 


24 


Assessing South Africa’s approaches to privacy in digital contact tracing 



Health officials involved in policy development described a similar need for an iterative 
approach in responding to the challenges of the pandemic. Said one: 

We’ve had to think on our feet. We’ve had to think fast. We’ve had to think [about] 
effeotiveness quiokiy, we’ve had to think [about] soaie quiokiy. We were to think 
[about] a variety of oontexts quiokiy And I think aii those made us take one or 
another deoisions aiong the way. Initiaity with COVID-19, oontaot traoing was fine... 
But we knew very soon we’ii probabiy faoe a simitar probiem to other oountries, 
and manuai oontaot traoing wiii not keep up, and in faot, we aiready saw signs of it 
not keeping up eariy on in the pandemio. So we were aiways hunting for a soiution 
that we oouid use to try shift some of the work we have to do onto teohnoiogy 
Eariy on, we tried out the mobiie network operator data as the basis for oontaot 
traoing, and there were obviousiy teohnoiogioai issues, but there were iegai issues 
and there were aiso privaoy oonoerns. We had to figure out something eise that 
was better and more enabiing for the heaithoare workers, enabiing the patients 
and enabiing the oontaots of those patients, efc.®^ 


67 Interview with Gaurang Tanna. 
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The shift to other approaches 



Before the mobile network approaoh was even fully abandoned, the National Department 
of Health was already investigating other digital interventions for oontaot traoing - first, 
through a WhatsApp-SMS suite branded as CovidConneot, and more reoently through the 
launoh of the Covid Alert South Afrioa app. Separately, South Afrioa’s largest mobile network 
operator, Vodaoom, began sharing aggregate data from its networks with several looal 
and provinoial government authorities, as well as the National Institute for Communioable 
Diseases and the Counoil for Soientifio and Industrial Researoh (CSIR), a state-owned 
researoh and teohnology agenoy.®® 

While eaoh of these oould be seen as a weloome move from the ill-oonsidered first 
approaoh, it is troubling to note that eaoh intervention was designed, and in some oases 
implemented, with no prior publio announoement or oonsultation. While this oan easily be 
understood as a result of the enormous burden on publio health authorities, it may spell ill 
for publio polioy, and publio trust. 


CovidConnect 


From early May, the National 
Department of Health started work 
on the messaging suite known 
as CovidConneot with a range of 
private seotor providers, inoluding 
GovChat, Telkom BCX, the Praekelt 
Foundation. 





Hi this is an official Dept of 

Health SMS. Thank you for testing for 
COVID. Knowing your result is the first 
step to protecting yourself and your 
family. WhatsApp RESULTS to 
-'.•■..'i - or click . 


Use the COVID Alert SA app to 
protect your loved ones and 
community. If you test positive for 
COVID-19 , upload this unique pin 

into the COVID Alert app to 
anonymously notify other app users. 
Start using the app today > , 


& & o 


< 62 GovChat ECD 03 

Your Official Covid19 Test Results; 

tested 

POSITIVE! 

Lab reference number: 

Test date; 

Don't Panic. Remember that most people 
with COVID-19 have a mild illness and 
recover fully after 10 days. 

You have the power to #FlattenTheCurve 
and #StopTheSpread of COVID-19 to 
other people you were in contact with. You 
and your close contacts must self-isolate 
for 10-days, monitor symptoms and look 
after yourselves over the next 2 weeks. 

You can find more information on how to 
do this at: 

1. the NICD website (nnp5: //tinvur|.com / 
NICDCovid19Case 1: or 

2. Department of Health website 
(https:/ /tinvurl.eom/DoHCovid19Case l: Or 

3. the National COVID-19 Hotline; 
0800029999 :or 

4. If you live in the Western Cape 
Province, the Western Cape COVID-19 
Hotline: 021 928 4102 

Use this service: 

- To MONITOR yourself and get health 
support. 


68 Email from B Kennedy, Vodacom spokesperson, on 5 October 2020, 
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The CovidConnect platform uses a combination of WhatsApp and SMS interaction to 
invite users who receive a positive Covid-19 diagnosis to notify nominated contacts.®® 
A person who undergoes a Covid-19 test receives a notification by SMS sent by Telkom 
BCX, directing the person to the GovChat WhatsApp bot channel in order to receive 
their result. There, they can also get further health support, and provide names and 
cell numbers of contacts whom they would like to receive an exposure notification. 
The nominated contacts are sent from GovChat back to Telkom BCX. Telkom BCX 
then sends an SMS to each nominated contact directing them to a Praekelt-hosted 
WhatsApp channel (HealthCheck) informing them of their possible exposure, and inviting 
them to monitor their health status for the next 14 days. Its relatively low-tech blend of 
SMS and WhatsApp interaction are a design response to South Africa’s high uptake of 
WhatsApp, and restrictions on ‘broadcast’ using WhatsApp Business API. For users 
without a smartphone, the platform does make it possible to obtain their result from 
another WhatsApp cell number; officials also plan to roll out USSD channels to support 
access to results for people without smartphones. 

The Minister of Health publicly announced the launch of CovidConnect in mid-July 2020,'^'' 
but only after an initial pilot phase in the Western Cape, and rollout in all provinces. 

The Department of Health’s Gaurang Tanna explained that these tools were never 
meant to replace the work of manual contact-tracing, which is largely managed through 
provincial health departments. ‘This was never meant to replace, it was always meant to 
complement what they did, because we knew there would be in many scenarios where 
CovidConnect would not be sufficient.’ He estimated that the number of users who 
obtain their results via CovidConnect amounts to 22% of total cases, with fewer using 
the contact-tracing feature.'^® 

The Bluetooth app 

In September 2020, the Minister of Health announced the launch of the Covid Alert South 
Africa app, which was developed pro bono by Discovery Health using the Google-Apple 
exposure notification protocol.Google and Apple released the protocol in April 2020 as 

69 Spotlight, 'COVID-19: The trial and error of digital contact tracing in SA', 28 July 2020, https://www.spotlightnsp,co.za/2020/07/28/covid-19-the-trial-and-error-of-digital- 
contact-tracing-in-sa/ 

70 Interview with Gaurang Tanna, National Department of Health, on 28 September 2020, 

71 Statement by Minister of Health, 1 7 July 2020, https://saeoronavirus.eo.za/2020/07/17/health-department-launches-eovid-service-portal/ 

72 Presentation by Wolmarans, 17 July 2020, 

73 Interview with Gaurang Tanna, on 28 September 2020, 

74 Minister of Health, 1 September 2020, bttps://sacoronavirus,co,za/2020/09/01/department-of-health-launches-powerful-new-tool-to-strengthen-covid-19-contact-tracing/ 
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a privacy-preserving response to efforts by governments and a host of technology firms to 
develop contact-tracing apps. It works by allowing smartphones to exchange random 
proximity IDs over Bluetooth and oreate an anonymous, temporary reoord of proximity with 
other devioes; if a user has a oonfirmed Covid-19 ease, the app oan send an anonymous 
alert to other devioes that registered olose proximity in the preoeding 14 days. In doing so, 
the app oreates a framework for users to notify their oontaots of exposure to the virus, 
while sidestepping some of the major privaoy risks with other digitised approaohes: use of 
the app is voluntary, and it does not oolleot information 
about a user’s looation or oontaots.'^® Thus, the Covid Alert 
app appears not to revive the same searohing questions on 
privaoy proteotion of the government’s first approaohes to 
oontaot traoing, although its relianoe on digital inolusion in 
the South Afrioan oontext raises questions about its 
effioaoy.^® A study of equivalent apps in Europe found than 
they were ‘generally well-behaved from a privaoy point of 
view’ but did result in user and devioe data being oolleoted 
by Google servers.This points to the need for further 
researoh on the underlying seourity and data oolleotion 
oomponents of the South Afrioan app, a need potentially 
oomplioated by the faot that its souroe oode has not been 
published, unlike most international equivalents.'^® 


COVID-19 Positive 

By alerting others that they have come into close 
contact with someone who has tested positive for 
COVID-19, you are helping to break the chain of 
transmission. 

□ You shared your positive diagnosis on 

^^^■2020 


Next Steps 

If you have been diagnosed with COVID-19, it is 
important to follow the steps provided by a 
healthcare professional to help with your recovery 
and reduce transmission. 

Self-lsolate 

Do not leave your house for any reason, or 
receive visitors, while staying away from 
other members of your family. 

Monitor Symptoms 

If you develop worsening symptoms or have 
shortness of breath, contact a healthcare 
professional immediately. 

How are you feeling? 

If vni] feel verv ill nr evnerlenre shortness nf 

0 ♦ ® 


Aggregate mobile data 


The amendment to contact-tracing regulations on 26 June 2020 made provision for the 
Department of Health to access to mobile data for ‘geospatial hotspot mapping’. In fact, 
at least one network operator had already been sharing aggregate data with certain public 
bodies for at least a month - Vodacom. 


According to a Vodacom spokesperson, the company is sharing aggregated data with 
the NICD, the CSIR, the Free State Department of Health, the Eastern Cape Provincial 
Department of Health, and the City of Cape Town. 


75 Google & Apple, Exposure Notifications: Using technology to help public health authorities fight COVID-19, n.d, https://www.google,com/Covicl-19/exposurenotifications/ 

76 Research ICT Africa, 'Contact tracing in South Africa, Policy Brief 4, September 2020, https://researchictafrica.net/wp/wp-content/uploads/2020/09/RIA-Policy-Brief-Contact- 
Tracing-Sep2020,pdf 

77 Privacy International, 'Study finds gaps in CAEN contact tracing apps privacy protection’, n.d,, https://privacyinternational.org/examples/4189/study-finds-gaps-gaen-contact- 
tracing-apps-privacy-protection 

78 XDA News, List of the countries using Google and Apple's COVID-19 Contact Tracing API, n.d, https://www.xda-developers,com/google-apple-covid-19-contact-tracing- 
exposure-notifications-api-app-list-countries/ 
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Vodacom has provided aggregated data to the South Afrioan government to assist 
with traoking and traoing the spread of the virus. This inoiudes mobiiity anaiytios 
at a ward ievei reiated to the iookdown and popuiation movements for disease 
spread modeiiing at a ward and distriot ievei... Sharing of anonymised aggregated 
data is through a dedioated seoure dashboard and a data sharing portai. 

Similar arrangements have appeared between network operators and health authorities in 
a number of other oountries over the oourse of the year.®° 

Aooording to one offioial with aooess to the system, the interfaoe gives offioials insight into 
how many devioes are oonneoted to a partioular part of Vodaoom’s network at any given 
time, by providing a simple oount of the devioes without any identifying information about 
the devioes themselves. 

One dataset in the interfaoe gives a simple oount of unique devioes oonneoted in a partioular 
area - in other words, giving insight into population density. A seoond dataset shows a 
oount of the total number of unique devioes leaving one part of the network and arriving 
at another, whioh gives insight into population movements and oommuter patterns. These 
datasets were reportedly used to guide modelling for Covid-19 in South Afrioa,®"' but oould 
also be used to monitor oomplianoe with Iookdown oonditions. 

The CSIR’s Information and Cyber Seourity Centre has used Vodaoom’s aggregate network 
data for a ‘COVID-19 Traoker’ projeot that models population mobility, whioh the agenoy 
said oould be used to help health administrators identify potential hotspots, and allooate 
resouroes or issue alerts in partioular areas. It added that the CSIR saw applioations for 
the system beyond Covid-19, inoluding orime prevention.®^ The same unit within the CSIR 
is oarrying out Covid-19 ‘hotspot mapping’ for the National Department of Health; while it 
has been reported that this mapping servioe uses aggregate data from mobile networks 
showing population movement, in addition to approximate looation of positive Covid19 
eases from the National Institute for Communieable Diseases,®® this appears not to be 
the ease. Aooording to a CSIR manager of the projeot, the hotspot mapping does not use 
network data at all, only data on the looations of Covid-19 eases from the NICD, whioh is 
approximated in order to proteot the anonymity of individual patients.®'^ 

79 Email from B Kennedy, Vodacom spokesperson, on 5 October 2020, 

80 Privacy International, tracking the global response to Covid-19, https://privacyinternational.org/examples/tracking-global-response-covid-19 

81 Interview with S Silal, MASHA, on 11 July 2020. 

82 CSIR media release, 30 June 2020, https://www.csir.co,za/tracking-mobility-better-understand-covid-19 

83 See D Johnson, '/\ssessment of contact tracing options for South Africa,' Research ICT Africa, October 2020,20, https://researchictafrica.net/publication/assessment-of-contact- 
tracing-apps-for-south-africa/ 

84 Email from Dr Jabu Mtsweni, CSIR, on 2 November 2020. 
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Further problems with 
the regulations 


Before turning to the lessons to be drawn from the unfolding events around South Afrioa’s 
digital oontaot-traoing approaohes, it is neoessary to outline a few remaining problems with 
the oontaot-traoing regulations. It has already been noted that, although the Department 
of Health has by all aooounts stopped seeking users’ mobile-network looation data for 
oontaot traoing, the 26 June amendments to the regulations aotually left these powers 
intaot. The amendment also appears to have expanded the purpose of the database that 
had been oreated through the regulations in 2 April. 


Keeping mobile network contact tracing ‘on the books’ 

The 2 April regulation stipulated that mobile looation data ‘... may only be obtained, used 
and disolosed when neoessary for the purposes of addressing, preventing or oombatting 
the spread of COVID-19 through the oontaot-traoing prooess.’ 

As detailed earlier, the 26 June amendment followed reoommendations from the Covid-19 
designated judge that oell phone looation data oannot be used for oontaot traoing, but that 
anonymised network data oould potentially be used for mapping pandemio ‘hotspots’. 
However, the amended regulations simply expanded the grounds for whioh the Department 
of Health oould aooess mobile data ‘when neoessary for the purposes of addressing, 
preventing or oombatting the spread of COVID-19 through the oontaot traoing prooess or 
geospatial hotspot mapping’ [emphasis added].®® 


85 Regulation 8{11 )b, per Government Gazette no 43476. 
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April 2020 



(2) The National Department of Health shall develop and 


maintain a national database to enable the tracing of persons who are known or 
reasonably suspected to have come into contact with any person known or 
reasonably suspected to have contracted COVID-19. 


"(2) The National Department of Health shall develop and maintain 
a national database in order to guide appropriate responses in addressing, 
preventing or combatting the spread of COVID-19, including contact tracing 
and geospatial hotspot mapping.”; 


June 2020 


The decision to retain this contact-tracing power, at least on paper, is difficult to justify, not 
least of all since the authorities have emphasised their desire to limit risks to privacy. All 
parties involved seem to agree that mobile data is effectively useless for contact tracing, 
and the 26 June amendment appeared to be a good-faith acknowledgement that the 
initial policy was misconceived. It is also unclear that individuals’ mobile location data is 
necessary for the purpose of hotspot mapping; while aggregated network data as provided 
by Vodacom can be used to map population density, the approximate location of individual 
Covid-19 cases could arguably be drawn from residential information that is collected as 
a matter of course when a person undergoes a test for Covid-19, or simply deduced from 
the location where a positive test sample was collected. At the very least, if a person’s 
mobile location data is necessary for hotspot mapping, nobody appears to have made that 
case publicly in South Africa. 


Expanding the purpose for data collection 

The amendment of 26 June also expanded the purpose for collection and storage of 
people’s personal information during the pandemic. The 2 April regulations provided for 
the National Department of Health to establish a ‘Covid-19 Tracing Database,’ to store 
a range of personal information about people who get tested for Covid-19, and people 
who are known or suspected to have been exposed to the virus. The regulation gave 
this database a very clear and limited purpose: to ‘enable the tracing of persons’ with 
Covid-19.®® The 26 June amendment effectively repurposed this database, renaming it 

86 Regulation 11 (H)c, per Government Gazette no 43199. 
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‘the Covid-19 Database’, and expanding its purpose to ‘guidfing] appropriate responses 
in addressing, preventing or oombatting the spread of Covid-19, inoiuding oontaot traoing 
and geospatial hotspot mapping [emphasis added].In other words, the database oould 
serve any purpose deemed neoessary to guiding polioy responses to Covid-19. 

April 2020 


(11) The information referred to in subregulation (10)— 

(a) may only be obtained in relation to the location or movements of persons 
during the period 5 March 2020 to the date on which the national state of 
disaster has lapsed or has been terminated; 

(b) may only be obtained, used or disclosed by authorised persons and may 
only be obtained, used and disclosed when necessary for the purposes of 
addressing, preventing or combatting the spread of COVID-19 through 
the contact tracing process; 


purposes of addressing, preventing or combatting the spread of COVID- 
19 through the contact tracing process or geospatial hotspot mapping;"; 


June 2020 


Again, this amendment appears to have been handed down without explanation. There 
may well be an underlying publio-health imperative for expanding the purpose of oentralised 
oolleotion of data about people exposed to the virus, whioh may outweigh the data 
proteotion risks, but the publio ease has yet to be made. 

One explanation given for some of these ‘loose ends’ is that they are also a produet of 
iterative polioymaking. The offioial leading the development of the Department of Health’s 
digital platforms said the regulations were amended at a time when CovidConneet and 
CovidAlert had yet to be implemented at seale, while their regulatory needs were still 
unolear: ‘It was important to future proof legislation in oase we needed to move beyond 
the envisaged methods. The evolution of oontaot traoing was through learning from 
implementation.’®® 


87 Regulation 8(2), per Government Gazette no 43476. 

88 Email from G Tanna, on 3 November 2020. 
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The lessons for privacy 


This research, while critical of in its findings, does not presume to downplay the 
seriousness of the publio-health ohallenges of the Covid-19 pandemio, nor the 
signifioant efforts of South Afrioa’s health authorities and healthoare workers to meet 
those ohallenges. Nor does it mean to suggest that any missteps in digital oontaot 
traoing were unique to South Afrioa. Quite the opposite. 

In addition to the oatastrophio impaot of the global ooronavirus pandemio on health and 
eoonomio well-being, it seems to be generally agreed that has been bad for privaoy. 
Certainly, aoross the world, the digitisation of many parts of publio life, the soramble 
for high-teoh tools for soreening, oontaot traoing and quarantine enforcement, and the 
gathering and oentralisation of huge amounts of health data, have presented very many 
ohallenges for data proteotion. The sheer urgenoy of the pandemio has resulted in a wide 
range of teohnologioal interventions based on assumptions that may be untested, and 
where the results have yet to be fully evaluated. 

In many respeots, the South Afrioan oase has followed this line. Its first approaohes to 
oontaot traoing were poorly designed, based on false assumptions, and fuelled by an 
understandable sense of panio, and they resulted in unneoessary intrusions on data 
proteotion prinoiples. The later approaohes seem more oarefully oonsidered, but have 
often been designed and implemented unilaterally, without publio oonsultation or sorutiny. 
While the good intentions underpinning these interventions is undeniable, there is a laok 
of publio information about the workings and performanoe of these systems outside of 
press releases and promotional oampaigns, and limited opportunity for publio debate 
about their merits. 

This in part refleets a troubling absenoe from key oversight bodies. Parliament’s health 
oommittee held just eight meetings on the government’s Covid-19 response in the first 
eight months of the pandemio.®® Qn the data proteotion elements of the pandemio. South 
Afriea’s naseent data authority, the Information Regulator, issued a brief guidanoe note in 


89 The committee did hoid a range ot other meetings through the year on non-CovidI 9 matters, such as reviews ot departmentai budgets and performanee pians, and briefings on 
the Nationai Heaith Insurance pian, Pariiamentary Monitoring Group website, Portfoiio Committee on Heaith: https://pmg.org.za/committee/63/ 
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April to affirm that it considered the use of mobile data for contact tracing to be lawful,®® 
but otherwise appears to have been largely disengaged from these events. 

This research has stopped short of making a finding on the efficacy and impact of the 
approaches to digital contact tracing that evolved from the shift away from mobile location 
data in South Africa. It remains an unresolved question - and not only in South Africa. 
The WHO, in recognising the potential for digital contact tracing systems in Covid-19, has 
noted there is limited understanding of their impact. A review of 15 studies on contact 
tracing systems, for both Covid-19 and other diseases, found no empirical evidence of 
the benefit of automated contact-tracing, and some studies with evidence that partly 
automated contact-tracing systems could result in better data collection and response 
rates compared to manual contact-tracing, but no research to measure any effect on 
Covid-19 transmission.®"' 

Public health officials have responded to scepticism about the potential efficacy of 
CovidConnect and Covid Alert platforms by arguing that every bit helps. Said one: ‘We 
have to approach things in a multimodal way, because our reach is then better. No system 
is universally effective, but some collective input of many systems may help.’®^ 

In a media interview, the Department of Health’s Gaurang Tanna made a similar point: 

‘People say the [Covid Alert] app is not perfect. I’ve studied hundreds of contact tracing 
solutions globally and I’ve not come up with one perfect solution. There is no panacea in 
digital contact tracing... Every 100 infections we avert with this technology we save two 
lives. And those two lives do matter. It’s a fairly low-cost inten/ention and it’s the least 
South Africans can do to help us fight Covid-19. ’ ®® 

Certainly, more research is needed, and more information about the targets and outcomes 
of each intervention. 

Cne risk of an approach rooted in technological determinism is that it leaves little room for 
pause, consultation and contestation. The realisation that human rights requires careful 

90 Information Regulator, 'Guidance note on the processing of personal information in the management and containment of Covid-19 pandemic in terms of the Protection of 
Personal Information Act,' 3 April 2020, https://iustice.gov.za/inforeg/docs/inforegsa-guidancenote-ppi-covid19-20200403.pdf 

91 Isobel Braithwaite and others, 'Automated and partly automated contact tracing: a systematic review to inform the control of COVID-19’, The Lancet Digital Health, 2,11,19 
August 2020, https://doi,org/10.1016/32589-7500(20)30184-9 

92 Interview with Kerrigan McCarthy, NICD, on 5 November 2020. 

93 Daily Maverick, 'COVID Alert SA app: The fine balance between public health, privacy and the power of the people’, 13 October 2020, https://www.dailymaverick.co.za/ 
article/2020-10-13-covid-alert-sa-app-the-fine-balance-between-public-health-privacy-and-the-power-of-the-people/ 
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protection in times of rapid technological change pre-dates the Covid-19 era®'^ - yet it is 
surely just as true now. 

Aside from the risks to privacy and other digital rights, there may be unknown opportunity 
costs when policy processes are driven by a fixation on technological solutions. As medical 
anthropologist Susan Erikson wrote in a scathing review of tech-driven responses to 
the West Africa ebola outbreaks of the 2010s, ‘In medical humanitarian crises, there is 
always the chance that new technologies will forestall more fundamental and essential 
steps and strategies of health crisis management. 

It is unclear what opportunity costs may have come from any misadventures in South 
Africa’s initial attempts at digital contact tracing. It may be that the time and resources 
put towards the pursuit of the proposed system could have been spent more effectively 
elsewhere, although this idea was disputed by the public-health officials interviewed for 
this research. It may also be that missteps throughout the rollout of digital strategies - 
policy failures, lack of deliberation or consultation, and miscommunication and lack of 
information - depleted another finite resource: public trust. Months later, fears about 
privacy and misinformation about government tracking appear to be barriers to uptake 
of the Covid Alert app.®® It cannot be said with certainty that past errors in South Africa’s 
Covid-19 response are a significant cause of these fears, but they probably did not help. 

Nevertheless, if the global narrative of privacy in a pandemic is that the crisis will spark 
emergency powers that are only ever excessive, expansive and ever-lasting, the South 
African case did not quite fit. 


94 See K O’Regan, 'Public law, the digital world and human rights: Challenges ahead’, Judicial Review, 25,1,2020, DOI: 10,1080/10854681.2020,1732742 

95 Erikson, 2018,333, 

96 Daily Maverick, 'COVID Alert SA app: The tine balance between public health, privacy and the power ot the people’, 13 October 2020, https://www.dailymaverick.co.za/ 
article/2020-10-13-covid-alert-sa-app-the-tine-balance-between-public-health-privacy-and-the-power-of-the-people/ 
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Recommendations 


As doomed as the polioy may have been, the privaoy proteotions in the April regulations 
suggested the work of a government, or at least publio servants within it, both willing and 
oapable of thinking oreatively and progressively about data proteotion and surveillanoe 
reform, even in atimeof orisis. It is remarkable to think that in the time of an unpreoedented 
global pandemio, and in the oourse of just a few days, the state was able to produoe a 
polioy framework that moved the water mark for surveillanoe oversight in South Afrioa, 
adopting positions that the Ministers of Polioe and State Seourity had fought against in 
RICA litigation just weeks before. As muoh as this is a oredit to the offioials involved, it is 
also a development that appears to have been shaped by years of aotivism, advooaoy 
and litigation towards surveillanoe reform. At the time of writing, the Constitutional Court’s 
judgment in amaBhungane was still pending, with no oertainty that it would rule in favour 
of the applioants. Yet in those April regulations, a small amaBhungane viotory oould 
already be found. 

However, the polioies desoribed here were passed as emergenoy regulations in Maroh 
2020, for a national state of disaster that was initially to last only three months. The Covid-19 
pandemio has proved to be lasting; it is past time to revisit and reassess these short-term 
polioies. 

The Covid-19 era is sure to generate many lessons and oautionary tales for teohnologioal 
responses to future orises. But this researoh has flagged the need for shorter-term 
interventions to be applied to the ourrent moment. These inolude that: 

• Parliament should initiate as a matter of urgenoy a publio and partioipatory review of the 
regulations pertaining to oontaot traoing and the Covid-19 database; 

• In the meantime, the power to aooess mobile looation data using these regulations 
should be removed from the polioy immediately, and all users whose data was 
aooessed using this meohanism must be notified promptly; 

• The National Department of Health should release full and detailed reporting on the 
design, implementation, and impaot of eaoh oomponent of South Afrioa’s Covid-19 
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digital health responses, including the initial use of mobile network data, CovidConnect 
and Covid Alert, and use of aggregated network data. This should include details of 
data-sharing agreements with all parties involved in the systems, key performance 
indicators for the systems, and costs incurred in the development and maintenance of 
each system; 

• The Department should commission independent security audits of each of these 
systems, and publish the findings with speed; 

• In recognition that there is still inadequate oversight of data protection questions at 
large, that the Information Regulator should work urgently to address its remaining 
capacity gaps, and develop a public plan for how it will take stewardship of Covid-19 
data protection questions in 2021. 

It is commonly said that those living through the Covid-19 era must adjust to a ‘new 
normal’. Perhaps so. But it is vital that this new normal is shaped by basic democratic 
principles of transparency, public participation, accountability, and protection for human 
rights - including, in this case, privacy and data protection. 
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